Ship prebuilt rain binary so downstream flakes don't compile from source

[thedavidmeister]

Every downstream repo that consumes rain.cli as a flake input (rain.flare, rainlang, rain.math.float, etc.) does so by referencing rain.defaultPackage.${system} in their dev shell. That triggers a Rust source build of the entire rain.cli crate every time the Nix store doesn't already have the result. Concretely:

• Cold-cache CI runs pay the full Rust compile cost (~minutes) every time, on top of all other build steps.
• Different consumer repos build rain.cli from source independently — no cache sharing.
• The dev-shell evaluation pulls in the full Rust dep tree as build-time inputs even when consumers only need the final rain binary on PATH.

What rainix already does for similar tools

rainix/flake.nix ships the-graph and goldsky via prebuilt-binary derivations:

the-graph = pkgs.stdenv.mkDerivation {
  pname = "the-graph";
  version = "0.69.2";
  src = builtins.fetchTarball {
    url = "https://github.com/graphprotocol/graph-tooling/releases/download/${release}/graph-${system-mapping.${system}}.tar.gz";
    sha256 = system-sha.${system};
  };
  installPhase = "mkdir -p $out; cp -r $src/* $out";
};

goldsky = pkgs.stdenv.mkDerivation {
  pname = "goldsky";
  src = builtins.fetchurl {
    url = "https://cli.goldsky.com/${release}/${system-mapping.${system}}/goldsky";
    sha256 = system-sha.${system};
  };
  ...
};

Both fetch prebuilt binaries from a release URL per system, install in seconds, no toolchain needed.

Proposal

1. Add a GitHub Actions release workflow that builds rain for x86_64-linux, x86_64-darwin, aarch64-darwin on each tag and uploads the binaries to the release.
2. Add a rain-bin derivation in flake.nix that fetchurls the right binary per system and chmod +x's it.
3. Make defaultPackage the rain-bin derivation (keep the from-source build available as a different output for development of rain.cli itself).
4. Bump downstream flake.locks; their dev shells should suddenly skip the Rust build.

Effect

Cold-cache nix develop for any consumer drops by however long the rain.cli build was taking — measurable single-digit minutes per CI run across many repos.